Re: (ITS#6572) slapd crash caused by refint's cn=config modification

[mbackes@symas.com]

--Apple-Mail-174--9407050
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Hello, Daniel and Quanah.

> I've tested your patch against HEAD and there seems to be a bug left =
open within (or even newly introduced by?) your patch:

> I've added Quanah into cc as his Call for 2.4.43RE testing seems to =
depend on this ITS.

> *** glibc detected *** /usr/local/openldap/sbin/slaptest: free(): =
invalid pointer: 0x09d507d8 ***

Heh, oops.  Extra & in the add case for one of the attributes.  Sorry =
for the noise.  See attached patch.

Matthew Backes
Symas Corporation
mbackes@symas.com


--Apple-Mail-174--9407050
Content-Disposition: attachment;
	filename=its-6572-amendment.txt
Content-Type: text/plain;
	x-unix-mode=0644;
	name="its-6572-amendment.txt"
Content-Transfer-Encoding: 7bit

Index: refint.c
===================================================================
RCS file: /repo/OpenLDAP/pkg/ldap/servers/slapd/overlays/refint.c,v
retrieving revision 1.19.2.14
diff -u -r1.19.2.14 refint.c
--- refint.c	13 Jun 2010 17:38:37 -0000	1.19.2.14
+++ refint.c	17 Jun 2010 18:04:18 -0000
@@ -263,8 +263,8 @@
 			break;
 		case REFINT_MODIFIERSNAME:
 			if ( !BER_BVISNULL( &c->value_ndn )) {
-				ch_free( &dd->refint_dn.bv_val );
-				ch_free( &dd->refint_ndn.bv_val );
+				ch_free( dd->refint_dn.bv_val );
+				ch_free( dd->refint_ndn.bv_val );
 				dd->refint_dn = c->value_dn;
 				dd->refint_ndn = c->value_ndn;
 				rc = 0;

--Apple-Mail-174--9407050--